vCISO | Published Author | CCP, CISSP, CISM, CRISC, CISA, CCSP. Expertly building resilient security cultures & managing risk. #CISO #InfoSec #Cybersecurity

SLC, UT
Joined September 2023
Hackers remotely manipulated supermarket fridges in France, pushing temperatures to 122°F. Spoiled food, reported fires, & millions in losses. Cyberattacks don't just steal data. They can disrupt the physical world. #IoTSecurity #Cybersecurity zurl.co/RnJkR
11
AI brings new opportunities & new risks as we use it every day. Shadow AI, unreliable answers, & the exposure of confidential data are growing concerns. Employees need approved tools & practical guidance, not just policies. #AISecurity #CyberAwareness zurl.co/k8YTl
4
AI agents reportedly made unauthorized edits to Wikipedia, attempted to misuse tools, & generated millions of requests. No breach was found, but the lesson is clear: autonomous AI needs boundaries, monitoring, & accountability. #Cybersecurity #AgenticAI zurl.co/2g3NB
7
You don't have to take an intimate photo for one to exist anymore. AI "nudify" tools can turn ordinary photos into fake explicit images used for bullying, harassment, or sextortion. The image may be fake. The harm isn't. #OnlineSafety #AI #Deepfakes 🔗zurl.co/nvI2W
122
A real Google login page doesn't always mean you're safe. Attackers can abuse OAuth permissions to gain Gmail/Drive access without stealing your password or bypassing MFA. Review your apps and AI agents. 🔗zurl.co/PuzGz #Cybersecurity #OAuth #GoogleWorkspace
18
That email from your boss could be fake. So could the invoice—and even the entire email conversation. Microsoft found 1M+ fraud emails in 3 days using executive/vendor impersonation & fabricated invoices. Don't trust the story. Verify the request.#AI zurl.co/8DeFu
7
A cyberattack cancels your flight. Who pays? A new DOT rule can treat cyberattacks as outside an airline’s control if it meets cybersecurity requirements. That may affect meals/hotels—but not necessarily your right to a refund. #Travel @Cybersecurity 🔗zurl.co/X9Osw
25
AI isn't just helping hackers anymore. Booz Allen testing found AI models can autonomously execute significant portions of a cyberattack—and some can complete the full kill chain. AI is making attacks faster, cheaper, & easier to scale.#Cybersecurity #CyberAttacks #AI #Infosec
9
Incident response isn't only technical. New CISA/FBI guidance says effective incident communications should be: Immediate.Technical.Transparent.Accountable.Iterative. Know what you'll say, who can say it, and how you'll communicate—before the incident.zurl.co/m9Gqg
10
Fake CAPTCHAs are tricking people into installing malware themselves. If “Verify You’re Human” asks you to press Windows + R, open PowerShell/Terminal or paste a command—stop. That’s not a CAPTCHA. #Cybersecurity #ClickFix #CyberSafety #SocialEngineering zurl.co/MaQQ5
38
Finding more vulnerabilities and fixing them faster doesn't necessarily mean we're winning. The better metric: are entire classes of vulnerabilities becoming less common? AI can help us play whack-a-mole faster—or engineer the holes away. zurl.co/HhTRv #Cybersecurity
3
Trail of Bits challenged GPT 5.6-Cyber to escape a VM. It escaped 3 times, eventually finding and chaining previously unknown vulnerabilities. Agent security can't rely on a VM boundary alone. We need to rethink containment. zurl.co/ohTar #AISecurity #Cybersecurity
1
32
85% say compromised credentials are a primary attack path, yet only 19% continuously monitor active credentials & automatically remediate exposure. Authentication succeeded ≠ identity can be trusted. #Cybersecurity #IAM zurl.co/jk8NY
5
My daughter has an Android head unit, so this caught my attention. Malware was delivered through a legitimate built-in updater, turning car infotainment systems into proxy botnet nodes. Trusted update mechanism=attack surface. 🔗zurl.co/Wqlw3#Cybersecurity #AutomotiveCybersecurity
28
CISA compromised both organizations. Only one stopped them. The difference wasn't preventing phishing. It was detecting & containing the intrusion before it escalated privileges and enabled lateral movement. A strong lesson in SOC effectiveness. zurl.co/IGclQ#Cybersecurity #SecOps
5
AliExpress caught using silent WebAudio processing as part of a much broader browser/device fingerprint. No cookie required. No obvious media. No meaningful user visibility. The bigger story is how much a browser can reveal (running JavaScript). zurl.co/boGL0#Cybersecurity #Privacy
10
Enterprise AI has another governance problem: employee trust. Security, privacy, and model controls matter, but so do transparency, workforce impact, and change management. We need to govern what AI can do and manage the changes AI brings. zurl.co/vW05b #AIGovernance
7
CTM360 found 3,000+ recruitment phishing URLs using fake interview portals, Browser-in-the-Browser logins, and real-time MFA relay. Correct credentials + successful MFA can still end in account takeover. 🔗zurl.co/Eq5zE #Cybersecurity #IdentitySecurity
12
MCP servers can become privileged non-human identities connecting AI agents to enterprise systems. That makes MCP security an IAM, secrets, AppSec, and AI governance problem, not just an AI problem. 🔗zurl.co/J2GVS #AISecurity #Cybersecurity
9
AI agents add another supply chain to secure: skills. Knowing an agent's identity and access isn't enough. We also need to know what instructions it trusts, where they came from, and what they can execute. zurl.co/92yDK #AISecurity #AgenticAI
1
3